Splunk Search

Multiple WHERE's in Query

inovexsean
Explorer

I'm trying to write an ANTLR grammar for Splunk queries and an example of the queries that my system receives is as follows :

...|append[|tstats count where (index=accm_*) earliest=1d@d latest=now where (index=accm_*) siteId="my_site",selectors{}.categories{}=* by selectors{}.categories{}|...

I do not see in the documentation how the previous statement could have where specified twice. Could someone please explain this to me?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

That is not valid syntax. Replace the second where with AND.

View solution in original post

woodcock
Esteemed Legend

That is not valid syntax. Replace the second where with AND.

inovexsean
Explorer

Thanks. That was my suspicion, but I'm not familiar enough with the QL to be certain. The queries are written by other people and we're just auditing them.

0 Karma

FrankVl
Ultra Champion

Not entirely sure what your on about either, but that second where doesn't make any sense there, same for the , after siteId="my_site".

0 Karma

woodcock
Esteemed Legend

Um ... .... ....... ? Please rephrase with 500% more text at a minimum.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...